From owner-freebsd-net@FreeBSD.ORG  Fri Nov 21 11:28:06 2014
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 1B266B33;
 Fri, 21 Nov 2014 11:28:06 +0000 (UTC)
Received: from mx1.sbone.de (mx1.sbone.de [IPv6:2a01:4f8:130:3ffc::401:25])
 (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
 (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id C7D40ED;
 Fri, 21 Nov 2014 11:28:05 +0000 (UTC)
Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587])
 (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.sbone.de (Postfix) with ESMTPS id C55FB25D3892;
 Fri, 21 Nov 2014 11:28:02 +0000 (UTC)
Received: from content-filter.sbone.de (content-filter.sbone.de
 [IPv6:fde9:577b:c1a9:31::2013:2742])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mail.sbone.de (Postfix) with ESMTPS id 02184C76FE0;
 Fri, 21 Nov 2014 11:28:01 +0000 (UTC)
X-Virus-Scanned: amavisd-new at sbone.de
Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587])
 by content-filter.sbone.de (content-filter.sbone.de
 [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024)
 with ESMTP id oS7gXTuralSA; Fri, 21 Nov 2014 11:28:00 +0000 (UTC)
Received: from [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6]
 (orange-tun0-ula.sbone.de [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6])
 (using TLSv1 with cipher AES128-SHA (128/128 bits))
 (No client certificate requested)
 by mail.sbone.de (Postfix) with ESMTPSA id D3303C76FD9;
 Fri, 21 Nov 2014 11:27:59 +0000 (UTC)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Subject: Re: IPsec is very broken...
From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
In-Reply-To: <20141120213526.GH24601@funkthat.com>
Date: Fri, 21 Nov 2014 11:27:57 +0000
Content-Transfer-Encoding: quoted-printable
Message-Id: <785031F3-7563-4314-A9A5-79666723C3E2@lists.zabbadoz.net>
References: <20141120213526.GH24601@funkthat.com>
To: John-Mark Gurney <jmg@funkthat.com>
X-Mailer: Apple Mail (2.1878.6)
Cc: freebsd-net@FreeBSD.org, freebsd-security@FreeBSD.org
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Nov 2014 11:28:06 -0000

On 20 Nov 2014, at 21:35 , John-Mark Gurney <jmg@funkthat.com> wrote:

> The first major issue I ran across was transport mode...  ae@ has been
> nice enough to get ICMP working in transport mode for IPv4 and IPv6,
> but it looks like TCP is still broken.  I haven't tested UDP yet...
> So, IPsec even w/o crypto is fundamentally broken here... It's clear
> that not many people run transport mode=85

Or that some people lately broke the code.


> If someone could create a good test suite that ensures makes sure =
basic
> IPsec traffic passes, that would be a huge win for us.  The tests
> should test a complete cross product of: { tunnel, transport } x
> { TCP, UDP, ICMP, any others? } x { IPv4, IPv6 }.  Please add to this
> list.

 + SCTP + IPcomp + IPv4/IPv6 mixes inside/outside + properly working =
enc(4)

If you get all that then add IPIP (gif) and GRE on the inside as well.

=97=20
Bjoern A. Zeeb             "Come on. Learn, goddamn it.", WarGames, 1983